Windows Logon Events Cheat Sheet: Event IDs, Types and Failure Codes
A shift-ready reference for Windows logon event IDs, logon types and failure codes, with KQL, SPL and PowerShell to show who logged on, from where and how.
5 Nov 20268 min read
Blue team notes, built in the open
Learn the SOC one alert at a time.
Practical walkthroughs on alert triage, detection engineering, incident response and threat hunting. Written step by step, with queries you can copy and labs you can repeat.
- 5posts
- 8topics
- 3levels
Live
Today in security
- 3h ago
- 3h ago
- 4h ago
- 4h ago
- 4h ago
- 5h ago
- 5h ago
Latest
Fresh from the blog
How to Hunt for C2 Beaconing in Proxy and EDR Logs
Find regular callback traffic in proxy and EDR logs with interval analysis in KQL and SPL, then separate real command and control from noisy legitimate software.
5 Nov 20269 min read
Triage a Brute Force Alert in 5 Steps (Event ID 4625)
A repeatable beginner workflow for the most common SOC alert: lots of failed Windows logons. Read the alert, enrich, scope, decide and document.
4 Nov 20262 min read
How to Investigate a Malicious Inbox Rule in Microsoft 365
A practical playbook for investigating a suspicious Microsoft 365 inbox rule: read the rule, scope the account, check what mail was exposed and contain it cleanly.
3 Nov 20269 min read
How to Detect LSASS Memory Access with Sysmon Event ID 10
Build a tuned LSASS access detection from Sysmon Event ID 10, with Splunk, Sentinel and Sigma versions, plus triage steps and the hardening that reduces your risk.
2 Nov 202612 min read
Topics
Pick a track
Alert Triage
Read an alert, gather context, decide: escalate, close or tune.
1 post
Detection Engineering
Sigma, KQL and SPL rules, tuning noise and testing coverage.
1 post
Incident Response
Containment, evidence handling and clear incident write-ups.
1 post
Threat Intelligence
IOCs, TTPs and turning reports into detections.
0 posts
Threat Hunting
Hypothesis-led hunts mapped to MITRE ATT&CK.
1 post
SIEM and Tools
Splunk, Sentinel, Elastic, EDR and SOAR in practice.
0 posts
Career and Certs
Breaking into the SOC, interviews and study plans.
0 posts
Cheat Sheets
Event IDs, query syntax and quick reference cards.
1 post
Learning path
New to the SOC? Start here
-
01
SOC fundamentals
Tiers, shifts, the alert lifecycle and the tools you will touch on day one.
Open track → -
02
Alert triage
A repeatable workflow for reading alerts, enriching indicators and reaching a verdict.
Open track → -
03
Detection engineering
Write, test and tune rules so the SOC sees the right things with less noise.
Open track → -
04
Incident response
Contain, investigate and report, using a structure that holds up under pressure.
Open track →
Daily SOC tips on X
Short threads on detections, event IDs, triage tricks and new posts as they go live.